CVEs published July 26, 2021
62 CVEs were published on July 26, 2021: 0 critical, 2 high.
- Published
- 62
- Critical
- 0
- High
- 2
- Medium
- 17
- Low
- 5
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- IBM i2 Analyze
- 5
- OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- 4
- IBM i2 Analyst's Notebook Premium
- 2
- JustArchiNET ArchiSteamFarm
- 2
- zmartzone mod_auth_openidc
- 2
- Apache Software Foundation Apache Directory Studio · org.ap…
- 1
- exiv2
- 1
- IBM i2 iBase
- 1
- IBM QRadar SIEM
- 1
- IBM Sterling Connect:Direct Browser User Interface
- 1
High 2
Medium, low and unrated 60
- CVE-2020-18430tinyexr 0.9.5 was discovered to contain an array index error in the tinyexr::DecodeEXRImage component, which can lead to a denial of service
- CVE-2020-18428tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component, which can lead to a denial of service
- CVE-2021-37576arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory
- CVE-2021-37555TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734.
- CVE-2020-23243Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" feature.
- CVE-2020-23242Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature.
- CVE-2020-23241Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
- CVE-2020-23240Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
- CVE-2020-23239Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.
- CVE-2020-17952A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.topthink/think
- CVE-2020-23238Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature.
- CVE-2021-32795Denial of Service via Steam chat in ArchiSteamFarmJustArchiNET ArchiSteamFarm
- CVE-2020-23234Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event lavalite/cms
- CVE-2021-32794Accidental removal of IPCPassword (< 5.1.2.4)JustArchiNET ArchiSteamFarm
- CVE-2020-18174A process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to escalate privileges.
- CVE-2020-18173A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code.
- CVE-2020-18172A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges.
- CVE-2020-18171TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to
- CVE-2020-18170An issue in the SeChangeNotifyPrivilege component of Abloy Key Manager Version 7.14301.0.0 allows attackers to escalate privileges via a cha
- CVE-2020-18169A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges.
- CVE-2021-36563The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module.
- CVE-2021-37478In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-order`, which results in arbitra
- CVE-2021-37477In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql injection on parameter `children_order`, which resu
- CVE-2021-37476In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `id` through a post request, w
- CVE-2021-37475In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on parameter `template-properties-order`,
- CVE-2021-37473In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `products-order` through a pos
- CVE-2021-37394In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.
- CVE-2021-37393In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page.
- CVE-2021-37392In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page.
- CVE-2021-32790Blind SQL Injection possible via Authenticated Web-hook Search API Endpointwoocommerce
- CVE-2021-25804A NULL-pointer dereference in "Open" in avi.c of VideoLAN VLC Media Player 3.0.11 can a denial of service (DOS) in the application.
- CVE-2021-25803A buffer overflow vulnerability in the vlc_input_attachment_New component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an o
- CVE-2021-25802A buffer overflow vulnerability in the AVI_ExtractSubtitle component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of
- CVE-2021-25801A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds
- CVE-2021-32631JSON Web Tokens not properly verifiednimble-platform common
- CVE-2021-33629isula-build before 0.9.5-6 can cause a program crash, when building container images, some functions for processing external data do not rem
- CVE-2021-37534app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.
- CVE-2021-26824DM FingerTool v1.19 in the DM PD065 Secure USB is susceptible to improper authentication by a replay attack, allowing local attackers to byp
- CVE-2021-29784IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error messageIBM i2 Analyze
- CVE-2021-29770IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow an authenticated user to perform unauthorized actionsIBM i2 Analyze
- CVE-2021-29769IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authorization tokens or sessIBM i2 Analyze
- CVE-2021-29767IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed techIBM i2 Analyst's Notebook Premium
- CVE-2021-29766IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information wheIBM i2 Analyze
- CVE-2021-20560IBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and 1.5.0.2 could allow a remote attacker to hijack the clicking action of the viIBM Sterling Connect:Direct Browser User Interface
- CVE-2021-20431IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtaiIBM i2 Analyst's Notebook Premium
- CVE-2021-20430IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information wheIBM i2 Analyze
- CVE-2021-20337IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected cryptographic algorithms that could allow an attackerIBM QRadar SIEM
- CVE-2021-22144In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack wasorg.elasticsearch:elasticsearch
- CVE-2020-12681Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by
- CVE-2021-35030A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and cZyxel GS1900-8 Firmware
- CVE-2021-33900StartTLS and SASL confidentiality protection bypassApache Software Foundation Apache Directory Studio · org.ap…
- CVE-2021-36092XSS attack using special link in emailOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2021-36091Unautorized access to the calendar appointmentsOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2021-21443Unautorized listing of the customer user emailsOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2021-21442XSS vulnerability in Time AccountingOTRS AG Time Accounting
- CVE-2021-21440Support Bundle includes S/Mime and PGP keysOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2021-31292An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of sexiv2
- CVE-2021-32791Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidczmartzone mod_auth_openidc
- CVE-2021-32792XSS vulnerability when using OIDCPreservePost On in mod_auth_openidczmartzone mod_auth_openidc
- CVE-2021-3664Open Redirect in unshiftio/url-parseunshiftio/url-parse · url-parse